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The Goldenberg-Vaidman (GV) quantum key distribution (QKD) protocol, which uses orthogonal 
encoding states, works by restricting the class of operations available to an eavesdropper. We point 
out that its security arises ultimately from duality, whereas that of BB84-class protocols arises from 
Heisenberg uncertainty. We generalize the GV protocol to protocols based on encoding with multi- 
partite orthogonal states, by modifying existing schemes for quantum secure direct communication 
(QSDC). However, the method of timing the wavepackets, crucial to GV, is no longer needed, and is 
replaced with a procedure for re-ordering the particles. The security of the extended GV protocol is 
shown to arise from monogamy of entanglement, which may in this sense be regarded as generalizing 
duality. The tolerable error rate is determined under a simple single-qubit attack model. 
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I. INTRODUCTION 

Since the advent of the Bennett-Brassard 1984 (BB84) protocol for quantum key distribution (QKD) in 1984 pQ, 
several protocols for different cryptographic tasks have been proposed [2r[6]. In BB84-type protocols, the encoding 
and checking uses non-orthogonal states (conjugate coding) of an internal degree of freedom. By contrast, in the 
Goldenberg-Vaidman [3] protocol (GV), the encoding is accomplished with orthogonal states consisting of superposi- 
tions of localized and geographically separated wave packets, and error checking is also done in the same basis. GV 
has recently been experimentally implemented [7]. 

Although most of the initial proposals [IrS] on quantum cryptography were concentrated around QKD, it was soon 
realized that quantum states can be used for more complex and more specific cryptographic tasks. For example, in 
1999, Shimizu and Imoto [6] proposed a protocol for direct secured quantum communication using entangled photon 
pairs. In this type of protocols, unlike in BB84-type of protocols, secure quantum communication is possible without 
the intermediary generation of keys. 

Such protocols of direct quantum communications are broadly divided into two classes: a) Protocols for deterministic 
secure quantum communication (DSQC) [8 and b) protocols for quantum secure direct communication (QSDC) 0[9]. 
In DSQC, the receiver can read out the secret message only after the transmission of at least one bit of additional 
classical information for each qubit. By contrast, no such transmission of classical information is required in QSDC. 

A large number of QSDC and DSQC protocols have been proposed in the recent past (cf. [5] and references 
therein). A common feature among these protocols is that they encode secret bits via orthogonal quantum states (so 
that the receiver can decode information unilaterally, as in QSDC, or with a 1-bit assist, as in DSQC), but exploit 
non-orthogonal states to detect eavesdropping and obtain the required security. The observation of this symmetry 
leads to the question of whether the use of non-orthogonal states can be entirely dispensed with in QSDC and DSQC. 
The present article aims to answer this question, in particular, by showing that the modified QSDC protocols obtained 
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by giving up conjugate coding can be considered as a generalization of GV to multiparticle systems. 

It is worth noting that the main difference between BB84-type protocols and GV pertains to the manner of error 
checking, rather than of encoding bits. For example, in BB84, Alice and Bob may deliberately decode only qubits of a 
given basis. In the Ping-pong (PP) [5] and Deng-Long-Liu (DLL) [TU] protocols, which also belong to the BB84-class, 
encoding is done with orthogonal states, but error checking requires monitoring two non-commuting observables- in 
fact, mutually unbiased bases (MUBs). By contrast, measurement in single basis is sufficient for the GV protocol. 

As we clarify below, the security of BB84-class protocols arises from Heisenberg uncertainty whereas that of GV (as 
also that of the recently proposed N09 protocol [TT]) arises ultimately from duality [T2], the trade-off between single- 
particle coherence and the particle's quantum correlation with another particle, i.e., the unshareability of quantum 
coherence/correlation. Later we present arguments that suggest that it is the single-particle analog of the monogamy 
of quantum correlations [13] . 

In this work we identify other GV-class protocols, derived from existing QSDC protocols. After a general discussion 
on their security, we analyze their security under a simple error model, in which Eve is restricted to an incoherent 
single-qubit attack. The remaining part of the paper is organized as follows. In Section [IlJ we briefly describe the 
GV protocol and demonstrate how its security arises from duality. We also discuss some features distinguishing this 
protocol from BB84-type protocols. In Section III we briefly describe the Ping-Pong protocol (PP) [5], which is a 
QSDC protocol, and show how to turn it into a GV-type QKD protocol (PP GV ). The key point here is that the 
timing check of GV, fails, and must be replaced by some other method, which here is a reordering technique. A similar 



adaptation of the Cai-Li (CL) variant [2] of PP is also given. In Section |lVj we briefly describe the Deng-Long- Liu 
protocol (DLL) for QSDC [TU], and show how to modify it to a GV-class QKD protocol (DLL GV ). The security 
of these generalized GV-type protocols, and in specific its origin in the monogamy of entanglement, is discussed in 
Section [V| As an illustrative example, in Section |VI[ we consider a single-qubit error model, in which Eve is limited 
to an incoherent attack. Finally we dedicate Section [Vll| to conclusions and discussions. 



II. THE GV PROTOCOL 



The GV protocol works as follows: Let |0) and |1) be two localized wave packets of Alice' particle, represented by 
the qubit system S. They are used to construct two coding states, (j = 1, 2), obtained by the encoding operation: 

U) = ^(|o) + (-i) J |i», (i) 

where j £ {0, 1} represents the encoded bit. Alice sends Bob either \ip ) or \ipi) in such a way that |0) and |1) are not 
sent together, but along two different channels; |0) is sent first and |1) is delayed by time r which is greater than the 
traveling time (8) of particles from Alice to Bob. Thus |1) enters the channel only after |0) reaches Bob, and the two 
wave packets are never found together in the open. Bob delays |0) by time r, and recreates the superposition state 
after he receives He repeats the encoding operation of Eq. (TH) on to recover j. 
Alice and Bob perform the following two tests to detect Eve's possible malicious eavesdropping: 

1. They compare the sending time t s with the receiving time t r for each wave packet. Since the traveling time 
is 8 and the delay time is t, we must have t r = t s + 8 + r. This ensures that Eve cannot delay |0) until also 
having |1) simultaneously, which would have allowed her to decode \tpj}- Even so, she may replace both wave 
packets with a corresponding dummy. To avoid such an attack, the timing of transmission of |0) is kept random. 
Furthermore, 

2. Alice and Bob look for changes in the data by comparing over an authenticated classical channel, a portion of 
the transmitted bits with the same portion of the received bits. 

Because of the first of the above tests, Eve is unable to access the full state and is restricted to attacking 
one packet at a time. Eve's perspective can be quite generally captured by introducing an ancilla or probe P that 
interacts with Alice's particle according to: 

t/=|0)(Q|®C + |l)(l|(8)C , 1) (2) 

where Co and C\ are unitaries acting on the ancilla alone, conditioned on the channel that Alice's wave-packet is 
located in. Acting on the particle-ancilla system, this transforms an initial state ® \R)(R\ (where \R) is the initial 
'ready' state of the probe), after they are recombined by Bob using the encoding operation, to the state 
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where \u) = Cq\R) and \d) — C\\R). The probe is now left in the state: 

P ' P = \{\d){d\ + \u){u\). (4) 

The optimal positive operator-valued measure (POVM) to measure the probe in order to distinguish the paths is 
given by the elements 

1 - \d)(d\ 

1 + 1(42)1' 
i-|")H 

1 + K«|d>l' 

1-M a -M b . (5) 

For this symmetric case, the two paths can be distinguished with probability V = (u\M a \u) = (d\Mb\d) = 1 — 
The off-diagonal term in the {|0), |1)} basis in the reduced density operator of the particle pp prior to recombination 
defines coherence and is given by C = |(— = It follows that the which-path information V and 

coherence satisfy the duality relation 

V + C = l, (6) 

which is similar to the duality derived for path-distinguishability and visibility of interference of Ref. [T2]- More 
generally, allowing the ancilla to be in a possibly mixed state, then it can be shown that Eq. Q is replaced by 

P + C<1. (7) 

This is because the path distinguishability through optimization of the POVM is less efficient and coherence is a 
convex function of states. 

The duality aspect of the GV protocol's security is reflected in the fact that Bob's checking involves measurement 
in only a single basis. By contrast, the security of BB84-class protocols is based on the disturbance introduced in 
a basis through measurements in another, non-commuting basis. Thus the security is ultimately due to Heisenberg 
uncertainty, and requires measurement in two or more non-commuting bases, which are ideally MUBs. To elaborate 
this point, we observe that V and C refer only to one observable, not to two non-commuting observables. Indeed, it 
follows from Eq. |2| that, upto a local transformation, the interaction is given by \a)(a\ ® 1+ \b)(b\ ® C\C\, so that 
the probe measures the observable Q = CqCi = C Ci 15j, and both V and C are defined in terms of (0|Q|0). 

To use the terminology of wave-particle duality, the (legitimate) basis used by Alice and Bob observes the photon's 
'wave nature'. Eve, on the other hand, is restricted to monitor particle nature. Of course, it is not in her interest to 
obtain which-way information, but the GV timing control means that she is effectively restricted to observe particle 
nature, and they can detect her action because of duality. 

To contrast how security would arise from conjugate coding and hence Heisenberg uncertainty, we may expand GV 
to include, apart from \ipj), also as coding states, |0) and |1), encoding respectively for bit and 1. We will call the 
latter the rectilinear basis R and the former the diagonal basis D. Eve's attempt to obtain information in one or the 
other basis is restricted by (the entropic version of) the uncertainty relation: 

R(R)+R(D) < 1, (8) 

where R = i?(m||4), which is the relative entropy of the measured probability distribution with respect to a uniform 
distribution, denotes the entropic knowledge of measured outcomes m in a given basis |16) . In this case, Eq. ^ 
replaces Eq. ^ as the essential equation guaranteeing security; the timing test 1 is no longer needed, but Bob would 
have to monitor both bases. 

GV is a QKD protocol that cannot be directly used for QSDC. To see why, let us assume that instead of a random 
sequence of bits, Alice transmits a meaningful message to Bob by sending a sequence of \^j)'s by following GV. When 
Alice sends |0), Eve can hold it and send a dummy |0) to Bob without causing any delay. Later, when |1) is sent by 
Alice, Eve holds that also and sends a dummy |1) to Bob in some state \ipk}- Eve can appropriately superpose the 
original |0) and |1) and obtain the information encoded by Alice. 

The security check 2 will eventually reveal the existence of Eve, but by then Eve will have already obtained the 
information transmitted so far. This leakage is not a problem with QKD because the distributed information is simply 
a random key that may be safely discarded if Eve is found to know too much about it. 
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III. TURNING A PP PROTOCOL TO A GV PROTOCOL, PP GV 

All QKD protocols involve splitting of the information into two or more pieces, such that each piece by itself should 
be non-revealing of the encoded bit. This splitting of information can be done in several ways. For example, in GV, 
PP, CL [2] and DLL protocols, the information is split into two quantum pieces but in BB84, B92 and particle- 
reordering-based protocols, the division is quantum-classical. Further, in GV and DLL, the quantum communication 
is one-way, while in PP it is two-way. In PP, Bob keeps one qubit from an entangled pair with him and sends the 
other qubit to Alice: the information split is thus across a 'tensor-product cut', while in GV it is across a 'tensor-sum 
cut'. 

The original PP protocol is briefly described as below. 

PP1 Bob prepares the state |*+)® n , where |*+) = ^(|01) + 1 10)), and transmits all the first qubits (say A) of the 
Bell pairs to Alice, keeping the other half (B) with himself. 

PP2 Alice randomly chooses a set of ^ qubits from the string received by her to form a verification string, on which 
the BB84 subroutine to detect eavesdropping, is implemented by measuring in the MUBs {0, 1} or {+, — }. If 
sufficiently few errors are found, they proceed to the next step; else, they return to PP1. 

PP3 Alice randomly chooses half of the unmeasured qubits as verification string for the return path and encodes her 
message in the remaining f qubits. To encode a message, Alice does nothing if she wants to encode on a 
message qubit, and applies a NOT gate if she wants to encode 1. After the encoding operation, Alice sends all 
the qubits in her possession to Bob. 

PP4 Alice discloses the coordinates of the verification qubits after receiving authenticated acknowledgement of receipt 
of all the qubits from Bob. Bob applies the BB84 subroutine on the verification string and computes the error 
rate. 

PP5 If the error rate is tolerably low, then Bob performs Bell-state measurements on the remaining Bell pairs, and 
decodes the message. 

The CL protocol is just like PP, except that step PP3 is replaced by: 

CL3 Alice applies unitary operations /, X, iY and Z to encode 2 bits, of value 00, 01, 10 and 11 respectively. 

In a completely orthogonal-state-based protocol like GV, both error checking and encoding are done by using 
orthogonal states. PP employs orthogonal encoding, but error checking uses the BB84 subroutine with two (or more) 
non-commuting bases. To turn PP or CL into a GV-like protocol, which we call PP GV and CL GV , respectively, the 
error checking in them must be modified to employ only measurement in a single basis, given by that of the orthogonal 
encoding states, which is the Bell basis. 

To implement this, both particles belonging to a pair must be sent across the channel. Although they are sent in 
a way as not to both be available at the same time in the channel, per the GV requirement, there is a new danger 
here not present in the original GV protocol. Eve can measure the position of the incoming qubits without disturbing 
the encoded information. This is essentially equivalent to having timing information in the GV protocol. Knowing 
the position of the qubits, Eve replaces the first qubit with a dummy, measures it jointly with the second qubit, and 
based on the state determined, sends a second dummy accordingly. Clearly, an error check cannot reveal this attack. 
This problem does not arise in the GV protocol, because the individual particles are spatially separated wave-packets 
of a single particle, whose wave function would collapse under a measurement of position (a particulate property), 
thereby producing a detectable disturbance. 

To counter this, Bob randomly re-orders his qubits before transmission, revealing the reordering information only 
after Alice's receipt. Knowing the particle coordinates does not reveal to Eve which are the partner particles, and thus 
does not help Eve determine the encoded information, which, had it been successful, could have been used to decode 
the key/message and prepare noiseless dummies. We observe that reordering also means that the GV time control, 
which was required to physically separate legitimate particle pairs from Eve's perspective, is no longer needed. Thus 
reordering serves both the purpose of temporal separation and transmission timing randomization in the original GV 
protocol. 

To obtain a GV-like protocol, we modify PP by replacing steps PP1, PP2 and PP4 as follows: 

PP GV 1 Bob prepares the state |$+)® n . He keeps half of the second qubits of the Bell pairs with himself. On the 
remaining 3n/2 qubits he applies a random permutation operation n 3rl / 2 an d transmits them to Alice, n of the 
transmitted qubits are Bell pairs and remaining ^ are the partner particles of the particles remained with Bob. 
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PP GV 2 After receiving Alice's authenticated acknowledgment, Bob announces n n £ n 3ra / 2 ; the coordinates of the 
transmitted Bell pairs. Alice measures them in the Bell basis to determine if they are each in the state If 
the error detected by Alice is within a tolerable limit, they continue to the next step. Otherwise, they discard 
the protocol and restart from PP GV 1. 

PP GV 4 Alice discloses the coordinates of the verification qubits after receiving Bob's authenticated acknowledgement 
of receipt of all the qubits. Bob combines the qubits of verification string with their partner particles already 
in his possession and measures them in the Bell basis to compute the (return trip) error rate. 

The other steps in PP remain the same. Similarly, in the CL protocol, replacing step CL1, CL2 and CL4 by PP GV 1, 
PP GV 2 and PP GV 4 gives the GV version of CL, denoted CL GV . 

Briefly, security in pp GV and CL GV arise as follows. The reordering has the same effect as time control and 
time randomization in GV. Eve is unable to apply a 2-qubit operation on legitimate partner particles to determine 
the encoding inspite of their orthogonality. Any correlation she generates by interacting with individual particles will 
diminish the observed correlations between Alice and Bob because of restrictions on shareability quantum correlations. 
We return to this point in greater detail in Section [Vj 

At best, Eve can either entangle a sufficiently large system with the transmitted 3n/2 qubits, or replace them 
altogether 3n/2 dummies. The problem Eve faces is that through only local operations she should be able to collapse 
any n of the transmitted particles into an ordered state of n/2 pairs in the state \^ + ), which has exponentially low 
probability of success. 

ppGV (CL GV ) also serves as a 2-way 4-step QSDC protocol. Note that PP GV , is a QSDC protocol that requires 
only two encoding states. Traditionally it has been believed that while two non-orthogonal states are sufficient for 
QKD, at least 4 states are required for implementation of DSQC or QSDC. That is true for conjugate coding based 
protocols. For example, we may consider B92 protocol which is the only well-known 2-state QKD protocol. This 
protocol cannot be generalized to a QSDC protocol because Bob's outcome will not be perfectly correlated with 
Alice's input. Thus we have provided here the first ever 2-state protocol of QSDC and also the first ever orthogonal 
state based protocol of QSDC. These observations are motivating enough to explore the possibility of converting other 
existing conjugate-coding-based protocols of DSQC and QSDC to GV type protocol. In the next Section we modify 
DLL protocol into a GV protocol. 

IV. TURNING DLL PROTOCOL TO A GV PROTOCOL, DLL GV 

We have already mentioned that the CL protocol is a modified PP protocol that uses full power of dense coding. 
This simple idea of inclusion of dense coding to increase the efficiency of secure direct communication has considerably 
influenced the recent developments of QSDC and DSQC protocols. To be precise, DLL [10] can be viewed as modified 
CL in which the 2-way, 2-step quantum communication is 'unfolded' to a 1-way 2-step communication that uses dense 
coding. The DLL protocol is briefly described below. 

A. The DLL protocol 

DLL1 Alice prepares the state |*+)® n , where |*+) = -^(|01) + |10)), and transmits all the first qubits (say A) of 
the Bell pairs to Bob, keeping the other half (B) with herself. 

DLL2 Bob randomly chooses a set of ^ qubits from the string received by him to form a verification string, on which 
the BB84 subroutine to detect eavesdropping, is implemented by measuring in the non-commuting bases {0, 1} 
or {+, — }. If sufficiently few errors are found, then they proceed to the next step; else, they return to DLL1. 

DLL3 Alice randomly chooses half the qubits in her possession to form the verificiation string for the next round 
of communication, and encodes her message in the remaining ^ qubits. To encode a 2-bit key message, Alice 
applies one of the 4 Pauli operations /, X, iY, Z on her qubit. After the encoding operation, Alice sends all 
qubits in her possession to Bob. 

DLL4 Alice discloses the coordinates of the verification qubits after receiving authenticated acknowledgement of 
receipt of all the qubits from Bob. Bob applies a BB84 subroutine to the verification string and computes the 
error rate. 

DLL5 If the error rate is tolerably low, then Bob decodes the encoded states via a Bell-state measurement on the 
remaining Bell pairs, and classical post-processing. 
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Presenting the DLL protocol in this way helps us to visualize the inherent symmetry among PP, CL and DLL protocols. 

B. The modified DLL protocol, DLL GV 

Based on reasoning analogous to turning PP to PP GV , we propose the following GV-like version of DLL, which may 
be called DLL GV . As before, we retain the steps of DLL, replacing only steps DLL1, DLL2 and DLL4 as follows: 

DLL GV 1 Alice prepares the state |vr/+)®™. She keeps half of the first qubits of the Bell pairs with herself. On the 
remaining 3n/2 qubits she applies a random permutation operation n 3n / 2 an d transmits them to Bob; n of the 
transmitted qubits are Bell pairs while the remaining ? are the entangled partners of the particles remaining 
with Alice. 

DLL GV 2 After receiving Bob's authenticated acknowledgment, Alice announces H n g n 3 „y 2 j the coordinates of the 
transmitted Bell pairs. Bob measures them in the Bell basis to determine if they are each in the state \^ + )- If 
the error detected by Bob is within a tolerable limit, they continue to the next step. Otherwise, they discard 
the protocol and restart from DLL GV 1. 

DLL GV 4 Same as PP GV 4, except that the 'return trip' is replaced by Alice's second onward communication. 

V. SECURITY ANALYSIS: DUALITY AND MONOGAMY 

Suppose Eve aims to extract information by measuring Alice's qubits A in some basis. She can do so by having a 
probe interact with Alice's qubit and measuring the probe suitably. We assume the interaction between her probe in 
initial state \E), and Alice's particle as given by: 

\0)\E) -> cos6>|0)|e ) + sm9\l)\E ) 

\1)\E) -> cos0'|l)|ei) +sin0'|O>|£i), (9) 

where cos 2 9 (cos 2 9') is the probability that Eve is not detected when Alice transmits |0) (|1)) and Bob measures 
in the R = {|0),|1)} basis. For Eve to obtain maximum information, we require (eoki) = to ensure complete 
distinguishability. The requirement that she produces no errors entails that 9 = 0. 

Now, if Alice sends a state in the diagonal MUB D = ^(|0) ± |1)), then the resulting two-particle state is 

4|(|0, eo) ± |l,ei)), implying that Bob receives the maximally mixed state |(|0)(0| + |1)(1|). By measuring in the 
diagonal basis, Alice and Bob detect an outcome completely uncorrelated with Alice's classical input, allowing them 
to infer maximally Eve's intervention. Clearly, the optimal attack in one basis produces maximal error in the other 
(mutually unbiased) basis. The errors produced in the two bases are governed by the Heisenberg uncertainty principle: 

H(R)+H(p) > 1, (10) 

where H is the Shannon bi-partite entropy of the measured outcomes, which is the more familiar variant of Eq. 
(|8j). This implies that if the disturbance generated by measurement in one basis vanishes, then that generated by 
measurement in the other basis is 1 bit, i.e., the output is totally uncorrelated with the input. 

However, this form of error checking is disallowed in our case by virtue of our requirement that, in the manner of 
GV, conjugate bases should not be used: only one basis figures in the checking. Security in our case comes from the 
fact that Eve cannot access the full scope of 2-qubit operators. She is constrained to interact with the system qubits 
individually, and thus generates 3-particle entanglement, which by virtue of entanglement monogamy |13| . suppresses 
the two-party entanglement observed by Alice and Bob. Intuitively, this unshareability of quantum correlations can 
be understood as follows. Suppose A and B are in a maximally entangled pure state | V I' + ), and B is entangled with 
a third particle E. This entails that the joint bipartite system AB will be in a mixed state, contradicting our initial 
assumption of state purity. 

Alice and Bob detect this reduction in their two-partite entanglement as a drop in the fidelity in Bob's subsequent 
Bell-state measurerment. In the above example, setting (eo|ei) =9 = 0, the 3-party entanglement generated is 
4|(|00, eo) + 1 1 1 , ei ) ) , which is of the Greenberger-Horne-Zeilinger (GHZ) kind [T7]. It possesses maximal tri-partite 
entanglement, as quantified by the 3-tangle, r = £(A\BE) — £(A\B) — £(A\E), where £(X\Y) denotes the tangle, the 
square of the concurrence between system X and Y (13j . a measure of bi-partite entanglement. For states belonging 
to the stochastic local operations and classical communication (SLOCC) class GHZ, r > 0, while for the other SLOCC 
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class of three qubits, the W states, r = (TS]. Thus, quite generally, the bi-partite entanglement that Alice's qubit 
A shares with Bob's qubit B and E is constrained by: 

£{A\B)+£(A\E) <£{A\BE), (11) 

where the r.h.s is bounded above by 1 bit for a 3-qubit system. This implies that the entanglement generated by 
Eve to learn the encoded information diminishes £(A\B), and thus the quantum correlation observed by Bob in his 
Bell-state measurement. 

Like duality, monogamy essentially refers only to a single basis, the Bell basis, {\&j)}, given by |$o,i) = (|00) ± 
|11)) and |$ 2 , 3 ) = 7f (1 01) ± 1 10)). All quantities in Eq. (fill) can be defined in this basis and also determined by 
measurement in this basis. For a pure bipartite state, |\1/) = z2j a j\^o)-> concurrence is given by c = | Q^l; an( i the 
entanglement of formation by H (1 + \^J\ — c 2 ) [T5] . 

As a matter of foundational interest, the observation that monogamy of entanglement protects secrecy in the 
generalized GV protocol suggests that monogamy may be regarded as the multipartite equivalent of duality. This is 
consistent with the observation that these protocols require measurement in only a single fixed basis, and not in two 
or more non-commuting bases. Further, duality can be expressed as a kind of unshareability of a quantum resource, 
namely the combination of a system's coherence or purity and its nonlocal correlation with any other particle. 

We may then nominally try to re-express duality relation Eq. Q as a monogamy relation of the qubit system S 
with itself and the probe P: 

£{S\P) +£{S\S) < £(S\SP), (12) 
where, it should be noted, not all terms are obviously related to tangle or 3-tangle. We will examine two different 



interpretations, one based on entropy and the other on trace, under which to make sense of Eq. (12). In both cases 



£(S\P) will be a measure of entanglement, £(S , |S') a measure of the particle's coherence or purity, and £ (S\SP) 



quantifies a notion that encompasses a particle's entanglement and coherence/purity. Thus, Eq. (12) will quantify 
the intuition that the coherence of a particle can't be shared, because entanglement will decohere the particle's state, 
making it incoherent or mixed. 

Assuming that the two-particle state is pure, it follows from Eq. Q that the entropy of entanglement of the system 



PA is given by the monotonically increasing function H(V/2) of V . Thus in Eq. (12), we set 



£(S\P) = H (j). (13) 
Positing that the coherence term £(S\S) has the same functional form of C as £(S\P) has of V, we have: 

£(S\S) = h(~Y (14) 



which, for the pure state case, is just H ( J* } . The upper bound for the duality-as-monogamy equation ( 12 ) is found 



by maximizing the l.h.s with the identifications in Eqs. (13) and (14), which turns out to be about l.o2, occuring 



at V — 0.5. We identify this upper bound with the maximum of the quantity £(S\SP), which is interpreted as a 
joint entanglement-cum-coherence quantum resource. It can be shown that, in general when the two-particle state is 



mixed, this is a strict upper bound to the l.h.s of Eq. ( 12 ) under this interpretation, since both path distinguishability 
V and system coherence C are convex functions of probe purity. 

As another interpretation, again assuming a pure state of the bipartite system, we quantify £(S\P) by the mixedness 
T = 1 — Tr(p|) of the system or, equivalently, of the probe, and Q = £ (S\S) by purity of the system, Tr(pg). In 



this case, we have the equality (12), £(S\P) + £(S\S) = 1. More generally, given an initial mixed state of the 
probe, we quantify entanglement by the mimimum, 7~ mm , averaged over all pure states in ensembles that realize it, 
and £(S\S) by the corresponding average purity. In this case, we have £ (S\P) + £(S'|S') < 1, where the r.h.s may 
be considered as an upper bound on £ (S\SP), now interpreted as the system's extended coherence, the combined 
entanglement-cum-purity of system S. 

Thus, the origin of security in GV and its generalizations is ultimately not Heisenberg uncertainty, but unshareability 
of quantum coherence/correlation, a generalized monogamy. The extension of the GV protocol has the foundational 
significance of suggesting that duality and monogamy are facets of the same underlying quantum phenomenon [20] . 
As with GV, this highlights the fundamental difference in the origin of security of the GV-class and BB84-class of 
protocols. 



FIG. 1: Bob's and Eve's information, respectively, as a function of eavesdropping parameters 9 and A. 



VI. INCOHERENT SINGLE-QUBIT ATTACK: AN EXAMPLE 



By way of illustrating the practical application of the generalized GV protocols, we compute the tolerable error 
rate in the following simplified scenario, where Eve is limited to an incoherent attack using the one-qubit error model. 
As is usually done, any error observed by Alice and Bob is attributed to a putative Eve's intervention. However, as 
errors can arise also due to channel noise, to abort a protocol run in every detection of error would be practically 
unfeasible. Instead Alice and Bob need to model Eve's attack strategy, and estimate whether the Eve's information on 
their secret bits, as a function of observed noise, is too high to be eliminated by subsequent classical post-processing. 
If it is, only then do they abort the protocol run. 

As a specific example of the attack employed by Eve, we consider a model given in Ref . [51] , which is based on error 
models proposed by Niu and Griffiths [22]. Probes E$ an E\ interact with each transmitted qubit, being subjected 
to the interaction: 
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(15) 



where, furthermore (e | e i) = (Eq\Ei) = cos# by virtue of symmetry in the attack strategy [25]. An outline of a more 
general security proof is as follows. After some straightforward, but rather tedious calculation, the above attack can 
be shown to produce the reduced density operator 
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(16) 



Bi-partitc correlation arc quantified by the fidelity ($ + |p^ B |<I> + ) = (1 + cos 2 9) 2 . It follows that in order to produce 
no errors, Eve must ensure that 9 — 0, which by virtue of Eq. (15), implies that no entanglement is generated, and 
in fact |eo) = |ei) , implying a trivial interaction of the probe with Alice's qubit. 
The error rate observed by Alice and Bob is given by: 



e = 1 



(17) 



where $ € {$ ± ),|^ f± )} and p' — p'(9,X) is the corresponding two-particle state obtained assuming Eve attacks 
fraction A or the incoming particles with eavesdropping parameter 9. Bob's information Is is quantified as the Alice- 
Bob mutual information I (A : B) based on e (Fig. [l]A_). Eve's information is upper-bounded by the Holevo bound \ 
of the reduced density operator of the two probes (Fig. [l]B). 
The tolerable error rate is computed as: 



eo = min e, 
Ib-X=0 



(18) 
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the smallest error for which Ig just exceeds \- It m ay be considered as the problem of minimizing e subject to the 
constraint that Eve's information has zero excess over Bob's. Numerically, this is obtained as the points along the 
'cliff' in the binary map depicted in Fig. [2] A. Multiplying this with the error map produces a corresponding 'error 
cliff'. The required eo is obtained as the minimum e along this cliff. For the considered model, we found the tolerable 
error rate eo = 26.7%, as seen in Figure [2]B. This rather large tolerance is obviously due to the limited power of Eve's 
attack here. 

A similar analysis can be done for PP and CL, which yield tolerable error rates to be about 25% and for DLL, 
about 26%. Thus none of protocols offers, from the perspective of security against single-qubit attacks, an especial 
advantage over the others. It is an interesting question whether this remains true for more general attacks. 



VII. CONCLUSIONS AND DISCUSSIONS 



The possibility of orthogonal-state-based QKD protocols prompts us to revisit the foundations of quantum cryptog- 
raphy, in order to understand the ultimate origin of secrecy in the quantum world. It now appears that security arises 
in quantum cryptography in two (possibly related) ways: Heisenberg uncertainty and duality /monogamy. We have 
shown that the GV protocol generalizations can be obtained by adapting existing QSDC schemes. The possibility of 
this generalization offers the foundational insight into the essential unity of duality and monogamy. 

The pair reordering technique used here can also be applied to the original GV protocol. For the same reason as 
with the generalized GV protocols, this helps eliminate the need for time control. The incoming packets are stored in 
quantum memory, and analyzed after appropriate pairing based on the classical communication from Alice. 
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